291c41c2b004ffbdec29311ff4336c86b1ca132e3379a5949042c01cd4aca3fd

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 10:15

Target
PAGO.js
Size 89KB
Sample260807-map2yswscw
SHA256 291c41c2b004ffbdec29311ff4336c86b1ca132e3379a5949042c01cd4aca3fd
MD5 79366ade4f7165602471ffe010ca2347
SHA1 d0ce4d8cc32029b5054df683c4f32151c391e8d4
SHA512 231bb28112038469c4e0925a205737c274573f6c28d6fe80ba650b2c59e4ac7ad2dc7e265948d10ec94b6c30cf9c340d171268974b5e34d0261d803d0c98f2a5
SSDEEP 768:j5QngVchBjfDW/PXXn/ZPBTmoxfRUOBuUMXp6cQznTT9ARzRY168+fDL7lJNoJVW:OHmSeT68/AaX6Gnd3F7Rwi6ljIO3
TLSH
T1FE9310910A877480537767BFA36AA8E4EBB20B2702901927B83C7850DFF1D1ADED4D75
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PAGO.js
1⤵
- Badlisted process makes network request
PID:4712

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact